Commit:     508a92741a105e2e3d466cd727fb73154ebf08de
Parent:     480eccf9ae1073b87bb4fe118971fbf134a5bc61
Author:     Jeff Dike <[EMAIL PROTECTED]>
AuthorDate: Tue Sep 18 22:46:49 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Wed Sep 19 11:24:18 2007 -0700

    uml: fix irqstack crash
    This patch fixes a crash caused by an interrupt coming in when an IRQ stack
    is being torn down.  When this happens, handle_signal will loop, setting up
    the IRQ stack again because the tearing down had finished, and handling
    whatever signals had come in.
    However, to_irq_stack returns a mask of pending signals to be handled, plus
    bit zero is set if the IRQ stack was already active, and thus shouldn't be
    torn down.  This causes a problem because when handle_signal goes around
    the loop, sig will be zero, and to_irq_stack will duly set bit zero in the
    returned mask, faking handle_signal into believing that it shouldn't tear
    down the IRQ stack and return thread_info pointers back to their original
    This will eventually cause a crash, as the IRQ stack thread_info will
    continue pointing to the original task_struct and an interrupt will look
    into it after it has been freed.
    The fix is to stop passing a signal number into to_irq_stack.  Rather, the
    pending signals mask is initialized beforehand with the bit for sig already
    set.  References to sig in to_irq_stack can be replaced with references to
    the mask.
    Signed-off-by: Jeff Dike <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 arch/um/include/kern_util.h |    2 +-
 arch/um/kernel/irq.c        |    7 ++++---
 arch/um/os-Linux/signal.c   |    4 ++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/um/include/kern_util.h b/arch/um/include/kern_util.h
index 8d7f7c1..6c2be26 100644
--- a/arch/um/include/kern_util.h
+++ b/arch/um/include/kern_util.h
@@ -117,7 +117,7 @@ extern void sigio_handler(int sig, union uml_pt_regs *regs);
 extern void copy_sc(union uml_pt_regs *regs, void *from);
-unsigned long to_irq_stack(int sig, unsigned long *mask_out);
+extern unsigned long to_irq_stack(unsigned long *mask_out);
 unsigned long from_irq_stack(int nested);
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index 9870feb..cf0dd9c 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -518,13 +518,13 @@ int init_aio_irq(int irq, char *name, irq_handler_t 
 static unsigned long pending_mask;
-unsigned long to_irq_stack(int sig, unsigned long *mask_out)
+unsigned long to_irq_stack(unsigned long *mask_out)
        struct thread_info *ti;
        unsigned long mask, old;
        int nested;
-       mask = xchg(&pending_mask, 1 << sig);
+       mask = xchg(&pending_mask, *mask_out);
        if(mask != 0){
                /* If any interrupts come in at this point, we want to
                 * make sure that their bits aren't lost by our
@@ -534,7 +534,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out)
                 * and pending_mask contains a bit for each interrupt
                 * that came in.
-               old = 1 << sig;
+               old = *mask_out;
                do {
                        old |= mask;
                        mask = xchg(&pending_mask, old);
@@ -550,6 +550,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out)
                task = cpu_tasks[ti->cpu].task;
                tti = task_thread_info(task);
                *ti = *tti;
                ti->real_thread = tti;
                task->stack = ti;
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index 18e5c8b..b98f7ea 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -119,7 +119,7 @@ void (*handlers[_NSIG])(int sig, struct sigcontext *sc);
 void handle_signal(int sig, struct sigcontext *sc)
-       unsigned long pending = 0;
+       unsigned long pending = 1UL << sig;
        do {
                int nested, bail;
@@ -134,7 +134,7 @@ void handle_signal(int sig, struct sigcontext *sc)
                 * have to return, and the upper handler will deal
                 * with this interrupt.
-               bail = to_irq_stack(sig, &pending);
+               bail = to_irq_stack(&pending);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to